JADEPUFFER Exploits Langflow Flaw to Deploy AI-Focused ENCFORGE Ransomware

The agentic threat actor JADEPUFFER is exploiting a critical Langflow vulnerability to deploy ENCFORGE, ransomware designed to encrypt AI models, training datasets, vector indexes, and other machine-learning assets.

According to Sysdig’s investigation, the operator returned to a previously compromised Langflow server with a compiled ransomware binary and an adaptable container escape process.

Sysdig assesses that an AI agent handled reconnaissance, credential collection, internal service testing, payload deployment, and troubleshooting. Researchers observed it produce six scripts in five minutes and 24 seconds after its first attempt to deliver ENCFORGE failed.

JADEPUFFER exploits CVE-2025-3248 in Langflow

The attack begins with CVE-2025-3248, a critical missing-authentication vulnerability affecting the Langflow code-validation endpoint. Langflow provides an open-source platform for building applications and workflows powered by large language models.

Before the patch, remote attackers could send crafted requests to /api/v1/validate/code without authenticating. The endpoint could then execute attacker-controlled Python code on the server.

The official Langflow security advisory identifies versions before 1.3.0 as vulnerable. Version 1.3.0 added the protection needed to close this specific entry point.

Vulnerability detail	Information
CVE	CVE-2025-3248
Affected product	Langflow
Affected versions	Versions before 1.3.0
Patched version	1.3.0 for this vulnerability
Vulnerable endpoint	/api/v1/validate/code
Required authentication	None on vulnerable versions
Impact	Remote execution of arbitrary Python code

CISA previously confirmed active exploitation

CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog on May 5, 2025. The listing confirmed that attackers were already exploiting the flaw in real environments.

The agency’s security alert instructed federal organizations to apply vendor mitigations or discontinue affected products when protections were unavailable.

Internet-accessible Langflow deployments create an attractive entry point because they may contain AI provider keys, database credentials, cloud tokens, object-storage connections, and access to vector databases.

JADEPUFFER searched for credentials and internal services

After obtaining code execution, JADEPUFFER ran basic discovery commands to identify the user, processor architecture, hostname, and operating environment.

The actor searched for cloud keys, API tokens, database connection strings, and other credentials available to the Langflow process. It also probed reachable internal databases and cache services.

Researchers then observed JADEPUFFER locate /var/run/docker.sock and confirm that the Docker daemon responded. Access to this socket can allow a containerized process to create privileged containers and reach the underlying host.

• Collected information about the compromised server
• Searched the environment for credentials and API keys
• Tested internal databases and cache services
• Located and accessed the Docker socket
• Attempted to retrieve the ENCFORGE ransomware binary
• Adapted its deployment method when the initial transfer failed

Docker socket access provided a route to the host

The unrestricted Docker socket gave JADEPUFFER a powerful route outside the original Langflow container. This behavior did not require a separate Docker vulnerability.

A process with write access to the socket can instruct Docker to create a privileged container, share the host process namespace, and mount the host filesystem with write access.

JADEPUFFER used these capabilities to build a process for copying ENCFORGE through /proc/<pid>/root, launching it on the host, and checking whether encrypted files appeared.

Container setting	Security impact
Privileged: true	Grants extensive host-level capabilities
PidMode: host	Shares the host process namespace
NetworkMode: host	Shares the host network namespace
/:/host:rw	Mounts the host root filesystem with write access
nsenter --target 1	Enters host namespaces from the container

The AI agent created six scripts in minutes

JADEPUFFER’s initial attempt to download the ransomware did not place the expected file in its target directory. Rather than abandoning the operation, the actor changed its delivery plan.

The first script issued Docker commands through the socket. Later versions added process-filesystem copying, helper functions, temporary privileged containers, raw Unix socket communication, dynamic process discovery, and execution checks.

The completed script copied ENCFORGE to the host, performed a scan-only test, started live encryption, and counted files ending in .locked to verify the result.

1. Discover the target container’s host process ID.
2. Create a privileged container with host namespaces and filesystem access.
3. Copy ENCFORGE through the container process filesystem.
4. Run the ransomware in scan-only mode.
5. Launch the live encryption process on the host.
6. Search for .locked files to confirm execution.

What is ENCFORGE ransomware?

ENCFORGE is a statically compiled Go ransomware binary delivered under the name lockd. The observed sample used UPX 5.20 packing and contained the internal project name encfile.

The binary also references a companion key-generation program called keyforge. These internal names provide potential detection strings that may survive recompilation of the same codebase.

The ENCFORGE analysis found that the malware uses AES-256 in counter mode for file encryption and wraps the symmetric key with an embedded RSA-2048 public key.

ENCFORGE capability	Observed behavior
Programming language	Go 1.22.12
Packer	UPX 5.20
File encryption	AES-256-CTR
Key protection	RSA-2048
Encrypted extension	.locked
Target extension count	Approximately 180
Data theft component	Not found in the analyzed binary

ENCFORGE deliberately targets AI and ML files

The ransomware’s default extension list covers approximately 180 file types. The selection includes model weights, checkpoints, vector indexes, training datasets, embeddings, and data-science project files.

Its command-line interface also allows operators to add extensions and glob patterns. The built-in help text uses LoRA fine-tuning files and legacy GGML model weights as examples.

This focus separates ENCFORGE from ransomware that simply encrypts every common business document. The malware specifically recognizes formats used throughout modern AI development and deployment.

Asset category	Targeted examples
Model checkpoints	.ckpt, .pt, .pth, .h5
Model interchange and weights	.onnx, .safetensors, .pb
Local LLM formats	.gguf, .ggml
Vector indexes	.faiss
Training datasets	.parquet, .arrow, .tfrecord
Serialized data and arrays	.pkl, .pickle, .npy, .npz
Embedding data	.vec
Analytics databases	.duckdb

Ransomware can disrupt entire AI pipelines

A production model may represent repeated training runs, fine-tuning, testing, data preparation, and engineering work. Encrypting its stored artifacts can interrupt both model development and live inference services.

Clean backups can restore files, but the organization may still lose work completed after its most recent snapshot. Recovery becomes harder when the attacker also encrypts the proprietary datasets needed to rebuild models and vector indexes.

Sysdig estimated that recreating a production-grade fine-tuned model could cost between $75,000 and $500,000 in cloud computing and engineering work. Actual losses will depend on model size, data availability, and backup quality.

ENCFORGE uses encryption without a leak site

Researchers found no network functionality, cloud-storage client, or data-staging code inside the analyzed ENCFORGE binary. They also found no evidence of data exfiltration during the observed session.

The campaign therefore uses a single-extortion model based on file encryption. Sysdig did not identify a Tor payment portal or public leak site connected to ENCFORGE.

The ransomware kills processes that hold targeted files open, supports resuming interrupted encryption, and can delete itself after execution. Its notes instruct victims to contact [email protected].

• README
• HOW_TO_DECRYPT
• README_DECRYPT

The ransom email links ENCFORGE to JADEPUFFER

The email address embedded in ENCFORGE matches the contact used during Sysdig’s earlier JADEPUFFER database-extortion investigation.

Sysdig considers the reused address its strongest continuity indicator because it does not depend on infrastructure or source IP addresses that operators can quickly replace.

The new campaign also retained the previous Langflow entry point and adaptive behavior. However, it replaced temporary database scripts with a reusable ransomware tool designed for filesystem-wide encryption.

Earlier JADEPUFFER activity	ENCFORGE campaign
Temporary Python scripts	Compiled Go ransomware
Database-focused destruction	Filesystem-wide encryption
MySQL encryption functions	AES-256-CTR and RSA-2048
Database and Nacos targets	AI models, vector indexes, datasets, and other files
No observed campaign task ID	gcp_h1 and gcp_test

Langflow users should install a current release

Version 1.3.0 fixed CVE-2025-3248 by adding authentication to the vulnerable validation endpoint. However, stopping at that release may leave installations exposed to vulnerabilities disclosed later.

The vendor advisory confirms the original fix, while Sysdig recommends upgrading to version 1.9.1 or a newer supported release.

CISA’s inclusion of the flaw in its Known Exploited Vulnerabilities update means administrators should also investigate possible compromise instead of treating patch installation as the only required action.

1. Upgrade Langflow to version 1.9.1 or the latest supported release.
2. Remove unnecessary public access to Langflow deployments.
3. Review logs for requests to /api/v1/validate/code.
4. Rotate credentials accessible to the Langflow process.
5. Inspect containers and hosts for persistence or unexpected files.
6. Review activity involving the known source and delivery addresses.

How organizations can protect AI assets

Administrators should not mount the Docker socket inside Langflow containers unless a documented function requires it. If access cannot be removed, a restrictive socket proxy should limit the permitted Docker operations.

Langflow should run without root privileges and with minimal access to the host filesystem, model storage, cloud credentials, and internal services. Model directories should not be writable by unrelated web applications.

Organizations should maintain offline or immutable backups of model weights, datasets, fine-tuning artifacts, vector indexes, and pipeline configurations. Recovery tests should confirm that these assets can restore together in the correct versions.

• Alert when a web application accesses the Docker socket.
• Detect containers launched with privileged mode.
• Monitor host PID namespace sharing and root filesystem mounts.
• Alert on nsenter --target 1 inside application containers.
• Monitor mass creation of .locked files.
• Track changes to model and training-data directories.
• Keep provider API keys outside the Langflow runtime where possible.

Corrected ENCFORGE indicators of compromise

Type	Indicator	Description
Source IP	45.131.66[.]106	Observed JADEPUFFER source address
Delivery server	34.153.223[.]102:9191	ENCFORGE and staged interpreter server
Payload URL	hxxp://34.153.223[.]102:9191/.lockd	ENCFORGE download location
Interpreter path	/pv/bin/python	Staged CPython path
Interpreter path	/pv/bin/python3	Staged CPython path
File name	.lockd or lockd	ENCFORGE ransomware payload
SHA-256	8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2	Packed UPX ENCFORGE binary
SHA-256	ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328	Unpacked ENCFORGE binary
SHA-256	ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a	Staged CPython 3.14 binary
SHA-256	2378bf45bb54fb2defc460063c9b43e09870741b62692b7f6acbc3cd7898bb3	Embedded RSA-2048 DER public-key indicator
Email	[email protected]	Embedded ransom contact
Encrypted extension	.locked	Extension added to encrypted files
Ransom notes	README, HOW_TO_DECRYPT, README_DECRYPT	ENCFORGE ransom-note names
Internal names	encfile, keyforge	Ransomware project and companion key tool
Task IDs	gcp_h1, gcp_test	Observed ENCFORGE campaign identifiers

FAQ